---
id: "CVE-2026-38601"
kind: "vulnerability"
aliases: ["CVE-2026-38601"]
title: "gohttpserver: hardcoded session key lets attackers forge login cookies"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "codeskyblue/gohttpserver", "fixed": [], "affected": "<= 1.3.0", "ecosystem": "go"}]
ecosystems: []
tags: ["go", "gohttpserver", "openid", "package", "self-hosted"]
not_affected_if: ["auth-required-upstream", "no-openid-login", "unknown"]
published_at: "2026-11-03T17:18:13+00:00"
first_seen_at: "2026-11-03T17:21:57+00:00"
updated_at: "2026-11-03T17:26:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38601", "first_seen_at": "2026-11-03T17:21:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T17:26:12+00:00"}]
---

# gohttpserver: hardcoded session key lets attackers forge login cookies

The gohttpserver file server ships with a hardcoded session secret key in versions through 1.3.0. An attacker can forge session cookies to impersonate any user and bypass OpenID Connect login.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:codeskyblue/gohttpserver affected <= 1.3.0 fixed ?

## How to check

Run gohttpserver (any version up to 1.3.0, including the codeskyblue/gohttpserver Docker image) with OpenID login enabled? You are exposed. The source in openid-login.go builds the cookie store with the fixed string "something-very-secret", so there is no setting to change it in released versions. Check your start flags for the OpenID login option. Also check for a build from master that includes PR #233.

## Fix

No released fix: 1.3.0 is the latest release. Open PR #233 (unmerged when last seen) reads the session secret from GHS_SESSION_SECRET and falls back to a random 32-byte key.

## Timeline

- 2026-11-03T17:21:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-38601
- 2026-11-03T17:26:12+00:00 analyst — Read openid-login.go on master (hardcoded key) and open PR #233 (configurable GHS_SESSION_SECRET). NVD page not retrievable. No release past 1.3.0; project looks unmaintained. Not marked verified: no maintainer advisory. Sibling CVE-2026-38600 is the zip slip in the same PR.

## Documents

- [describes] gohttpserver openid-login.go (master) https://github.com/codeskyblue/gohttpserver/blob/master/openid-login.go
- [fix] PR #233: Zip Slip protection in unzipFile (open, unmerged) https://github.com/codeskyblue/gohttpserver/pull/233
- [mentions] gohttpserver releases (latest 1.3.0) https://github.com/codeskyblue/gohttpserver/releases

## From the sources

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_